Releases

AI-analyzed release notes for CNCF graduated and incubating projects.

URGENCY

All Action needed Check if affected Plan ahead

KIND

Category

All AI & ML CI/CD & App Delivery Kubernetes Core Networking & Messaging Observability Orchestration & Management Provisioning & Runtime Security Storage & Data

Project: SPIREClear ×

SPIREv1.15.2SecurityJul 9, 2026

ACTION 2CHECK 1OTHER 32View full analysis

A feature and behavior release that adds operator-facing configuration and integration options while changing supported inputs and runtime behavior. It also includes a dependency migration for disclosed CVEs and deprecates no existing operator feature.

Action needed (2)

securityMigration from github.com/docker/docker to github.com/moby/moby
Dependencies from github.com/docker/docker were migrated to their github.com/moby/moby equivalents to resolve CVEs. The migration ships in this release.
breakingRPC metrics from agent health check loopback calls
Agent health check loopback calls no longer emit RPC metrics. This reduces metrics noise in the agent.

Check if affected (1)

breakingJWT-SVID serving by the delegated API
Applies if you use the delegated API for admin or downstream entries.
The delegated API no longer serves JWT-SVIDs for admin or downstream entries. This behavior ships in the delegated API in this release.

Source ↗

SPIREv1.14.5SecurityApr 8, 2026

ACTION 1View full analysis

This release updates the Go dependency and toolchain to address multiple disclosed CVEs. It concerns deployments that rely on the release's bundled Go version.

Action needed (1)

securitycriticalThe Go toolchain, updated to 1.26.2
The release updates the Go toolchain to 1.26.2 to address CVE-2026-32282, CVE-2026-32289, CVE-2026-33810, CVE-2026-27144, CVE-2026-27143, CVE-2026-32288, CVE-2026-32283, CVE-2026-27140, and CVE-2026-32281.

Source ↗

SPIREv1.13.5SecurityApr 8, 2026

ACTION 1View full analysis

This release updates the Go dependency to address multiple disclosed CVEs. It concerns deployments that receive their Go runtime or builds from this release.

Action needed (1)

securitycriticalThe Go dependency, upgraded to 1.25.9
The release upgrades Go to 1.25.9 to address CVE-2026-32282, CVE-2026-32289, CVE-2026-27144, CVE-2026-27143, CVE-2026-32288, CVE-2026-32283, CVE-2026-27140, and CVE-2026-32281. The update ships in this release.

Source ↗

SPIREv1.14.3SecurityMar 18, 2026

ACTION 1CHECK 1OTHER 9View full analysis

A maintenance release adds agent version reporting, changes TLS policy behavior, improves performance, and corrects several defects. It also includes security fixes for selector logging and TLS certificate chain validation.

Action needed (1)

securityAgent-level selector logging removal
Selectors are no longer logged at the agent level to avoid potential leakage of sensitive information.

Check if affected (1)

securityServer TCP endpoint TLS session tickets disabled
Applies if you use the server TCP endpoint.
TLS session tickets are disabled on the server side, so VerifyPeerCertificate runs on every connection and TLS session ticket resumption cannot bypass SPIFFE certificate chain validation against the current trust bundle.

Source ↗

Browse by month